Bug 2548337 (CVE-2026-97032)

Summary: CVE-2026-97032 net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, amctagga, ansmith, anthomas, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, chfoley, crizzo, dhanak, dkeler, dpaolell, drosa, dschmidt, dsimansk, eglynn, ehelms, flucifre, ggainey, gmeno, groman, jbritton, jburrell, jdelft, jjoyce, jlanda, jpasqual, jpretori, jschluet, jturenov, jupierce, juwatts, kingland, kshier, lblicha, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, nmoumoul, ogajduse, osousa, pcreech, pjindal, ppalepu, ppostler, prdhamdh, rbobbitt, rchan, rhel-process-autobot, sausingh, sfeifer, sghai, sidsharm, simaishi, smallamp, sostapov, stcannon, suppawar, swoodman, thason, tmalecek, vereddy, vkarehfa, vlaad, watson-tool-maintainers, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-08 23:01:25 UTC 
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.